SB2021083138 - Multiple vulnerabilities in arborist package for npm

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) UNIX symbolic link following (CVE-ID: CVE-2021-39134)

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A local attacker can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

2) UNIX symbolic link following (CVE-ID: CVE-2021-39135)

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A local attacker can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

Remediation

Install update from vendor's website.

References

• https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc
• https://www.npmjs.com/package/@npmcli/arborist
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2